October 2026 - Devel - NFS Ganesha List Archives

[S] Change in ...nfs-ganesha[next]: client_mgr: prevent heap overflow in grpc_cltmgr_show_clients
by Jim Chen (GerritHub) 31 Oct '26

31 Oct '26

Jim Chen has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257476?usp=email ) Change subject: client_mgr: prevent heap overflow in grpc_cltmgr_show_clients ...................................................................... client_mgr: prevent heap overflow in grpc_cltmgr_show_clients grpc_cltmgr_show_clients() performs two separate foreach_gsh_client() passes without holding client_by_ip.cip_lock across both passes. In pass 1 it counts active clients and allocates show->clients for that count; in pass 2 it populates show->clients via grpc_show_fill_cb(). If new clients connect between pass 1 and pass 2, grpc_show_fill_cb() increments st->index past the allocated show->clients array capacity, causing a heap buffer overflow. Conversely, if clients are removed between pass 1 and pass 2, show->client_count remains larger than fill_st.index, leaving trailing array elements uninitialized. Track max_count in struct grpc_show_fill_state, stop iterating in grpc_show_fill_cb() once st->index reaches st->max_count, and update show->client_count to fill_st.index after pass 2 completes. Change-Id: Idff3fbb409ba87348823ecbddefa834fa77cf61e Signed-off-by: Jim Chen <czcbangkai(a)google.com> --- M src/support/client_mgr.c 1 file changed, 9 insertions(+), 1 deletion(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/76/1257476/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257476?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: Idff3fbb409ba87348823ecbddefa834fa77cf61e Gerrit-Change-Number: 1257476 Gerrit-PatchSet: 1 Gerrit-Owner: Jim Chen <czcbangkai(a)google.com>

1 0

[XS] Change in ...nfs-ganesha[next]: nfs4_op_delegreturn: verify state_type is STATE_TYPE_DELEG
by Jim Chen (GerritHub) 31 Oct '26

31 Oct '26

Jim Chen has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257475?usp=email ) Change subject: nfs4_op_delegreturn: verify state_type is STATE_TYPE_DELEG ...................................................................... nfs4_op_delegreturn: verify state_type is STATE_TYPE_DELEG RFC 5661 Section 18.8.3 and RFC 7530 Section 16.6.4 require the server to verify that the stateid passed to DELEGRETURN represents a delegation and return NFS4ERR_BAD_STATEID if a non-delegation stateid (such as an open, lock, or layout stateid) is supplied. Currently, nfs4_op_delegreturn() calls nfs4_Check_Stateid() with STATEID_SPECIAL_FOR_LOCK and immediately proceeds without verifying state_found->state_type == STATE_TYPE_DELEG. If a client supplies a valid open or lock stateid, DELEGRETURN corrupts delegation heuristics counters in deleg_heuristics_recall(), issues an unintended FSAL lease unlock, and deletes the active open or lock state via state_del_locked(). Verify that state_found->state_type == STATE_TYPE_DELEG before proceeding and fail with NFS4ERR_BAD_STATEID while releasing the state reference. Change-Id: I0d8583b5a5566ea76e6c9f78071281c0eadb6aa9 Signed-off-by: Jim Chen <czcbangkai(a)google.com> --- M src/Protocols/NFS/nfs4_op_delegreturn.c 1 file changed, 5 insertions(+), 0 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/75/1257475/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257475?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I0d8583b5a5566ea76e6c9f78071281c0eadb6aa9 Gerrit-Change-Number: 1257475 Gerrit-PatchSet: 1 Gerrit-Owner: Jim Chen <czcbangkai(a)google.com>

1 0

[S] Change in ...nfs-ganesha[next]: SAL: fix cross-client revocation checks and free mismatch in state_deleg
by Jim Chen (GerritHub) 31 Oct '26

31 Oct '26

Jim Chen has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257474?usp=email ) Change subject: SAL: fix cross-client revocation checks and free mismatch in state_deleg ...................................................................... SAL: fix cross-client revocation checks and free mismatch in state_deleg In src/SAL/state_deleg.c: 1. has_revoked_delegations_for_client() iterates over the global revoked_delegations_list and unconditionally sets found = true on the first entry without comparing the entry's clientid prefix in stateid.other against clientid->cid_clientid. A single revoked delegation on one client causes all other clients to appear as having revoked delegations. 2. atomic_remove_revoked_and_clear_flags() checks !glist_empty(&revoked_delegations_list) globally instead of checking whether any remaining revoked delegations belong to clientid. When another client still has a revoked delegation, a client calling FREE_STATEID never has its session has_revoked_delegations flag cleared and remains stuck in a SEQ4_STATUS_RECALLABLE_STATE_REVOKED recovery loop. 3. remove_revoked_stateid() frees entries allocated via gsh_malloc(sizeof(*entry), MEM_COMP_STATE) using raw libc free(entry) instead of gsh_free(entry, MEM_COMP_STATE). Filter revoked_delegations_list entries by clientid->cid_clientid in both has_revoked_delegations_for_client() and atomic_remove_revoked_and_clear_flags(), guard against a NULL clientid, and use gsh_free(entry, MEM_COMP_STATE) in remove_revoked_stateid(). Change-Id: I344ec08d371c7ba58790f936e4fa8d6f62e1c053 Signed-off-by: Jim Chen <czcbangkai(a)google.com> --- M src/SAL/state_deleg.c 1 file changed, 27 insertions(+), 6 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/74/1257474/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257474?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I344ec08d371c7ba58790f936e4fa8d6f62e1c053 Gerrit-Change-Number: 1257474 Gerrit-PatchSet: 1 Gerrit-Owner: Jim Chen <czcbangkai(a)google.com>

1 0

[XS] Change in ...nfs-ganesha[next]: NLM: a reclaim keeps the state that holds its lock (#1436)
by Vinícius Ferrão (GerritHub) 30 Oct '26

30 Oct '26

Vinícius Ferrão has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257469?usp=email ) Change subject: NLM: a reclaim keeps the state that holds its lock (#1436) ...................................................................... NLM: a reclaim keeps the state that holds its lock (#1436) A Linux client's reclaim carries NSM state 0. get_nlm_state() replaced the state_t of a lock the server still held, and closing its descriptor released the FSAL_VFS OFD lock. Keep the state_t when the request carries no NSM state. GitHub Issue: #1436 Change-Id: Id49347e93247f086b08daa3b9b3c413a9dda6061 Signed-off-by: Vinícius Ferrão <ferrao(a)versatushpc.com.br> --- M src/SAL/nlm_state.c 1 file changed, 2 insertions(+), 1 deletion(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/69/1257469/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257469?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: Id49347e93247f086b08daa3b9b3c413a9dda6061 Gerrit-Change-Number: 1257469 Gerrit-PatchSet: 1 Gerrit-Owner: Vinícius Ferrão <vinicius(a)ferrao.net.br>

1 0

Announce Push of V15.10
by Frank Filz 30 Oct '26

30 Oct '26

Branch next Tag:V15.10 NOTE: This merge has 42 patches in it, I will not cover all in the highlights. Merge Highlights * MaxOS Client quirk handling * FSAL_VFS support of 4.1 Named Attributes as xattrs * Samba-style create and directory masks and forced modes * CEPH ACL fixes * More validation of XDR arrays and opaques * Many more Signed-off-by: Frank S. Filz <ffilzlnx(a)mindspring.com> Contents: 38f542cd5e Frank S. Filz V15.10 560a1d634e Nishant Puri Fix five AddressSanitizer direct memory leaks 7c7ef0481b Kirill Gibelgaus [rdma-bind-addr] RDMA: honor Bind_Addr when creating the listener ddf586e02a Bae Seong Wook NLM: skip unused NSM notification startup e7d608c3f7 Vamsi Mulpuri FSAL_VFS: Sync parent directory after namespace changes (Issue #1426) afc67af320 Moritz Tanner log: Start crash handler monitor after daemonizing 6f61d235b4 Suhas Athani XDR: add per-field reasonableness limits for arrays and opaques c8961c6d47 Frank S. Filz clang-format some files 4eeed97f2b Suhas Athani idmapper: use NUL terminated strings for user and group names de180c4991 Evan Champion MDCACHE: survive directory entries removed outside Ganesha c007443cd4 Evan Champion macOS quirk: macOS_quirk_pad_handles ee621c4a8d Evan Champion macOS quirk: macOS_quirk_mounted_on_fileid 7ee30d982a Evan Champion macOS quirk: macOS_quirk_named_attr_truncate bdf4191f00 Evan Champion macOS quirk: macOS_quirk_named_attr_NVERIFY de88a6c7e1 Evan Champion macOS quirks: a way to apply them only to macOS clients a34d25761f Evan Champion NFSv4.1: recognise macOS clients from EXCHANGE_ID 235ec91bf9 Evan Champion FSAL_VFS: named attributes backed by user extended attributes 6f6989c1fd Evan Champion NFSv4: named attributes (OPENATTR) in the protocol and FSAL API df21667552 Evan Champion FSAL: mounted_on_fileid as an attribute, and from VFS for mount points 0a8a70a544 Evan Champion EXPORT: Samba-style create and directory masks and forced modes 725a5ee338 Bjorn Leffler MainNFSD: clear IPV6_V6ONLY on the AF_INET6 listeners 102ccb04a3 Bjorn Leffler idmapper: declare getgrouplist_func with gid_t 1996bd9e66 Rahul Rai GTest: initialize FSAL I/O arguments in latency tests 30945ea8e1 Sreedhar Agraharam Fix: Resolved python file syntax error by removing extra format specifier. b067d801a9 John Ramsden fix(rados-grace): shut down the client before process exit 514ea1676d xueqian.hu MDCACHE: force attr refresh after setattr when delegated d1e15030f6 Vinícius Ferrão LAYOUTRETURN: fix argument size with no pending recall (#1411) b0ede09547 Vinícius Ferrão LOCK: shorten the unknown lock owner to 15 bytes (#1420) 52f964a87f Vinícius Ferrão LOCK: describe the conflict in the reply to a blocked lock (#1430) 717c499231 Rajesh Prasad mdcache: defer reap of directory entries with live dir_chunk references 2701019883 Michael Diederich Prevent I/O error from a failed idmapping. If decode for ACL fattr during setattr fails - log message "Decode attr FAILED:" due to idmap, the call is failed with FATTR_XDR_FAILED that the client will show as IO-Error. The patch will change the error to NFS4ERR_BADOWNER instead. f6036773c3 marc eshel Allocate buffer size only for the required IO e3e6648644 marc eshel Add support for GPFS read delegations. d7e218a8d7 marc eshel Add config option for export xattr_support d326fed281 marc eshel Enable xattr only for GPFS version 5 and up. b19a5363e7 Sachin Punadikar CEPH: Use proper mode while creating files 08eb3c9ad3 Sachin Punadikar CEPH: Synthesize effective ACLs based on mode d23f8278f7 Jim Chen FSAL_VFS: fix inverted my_fd cleanup condition in vfs_open2 fileerr 9a15fdaa64 Jim Chen nfs4_op_copy: fix async copy_offload_state UAF/seqid race and state_t ref leak 5c5ffaf246 Jim Chen idmapper: prevent uid_cache UAF when looking up gss_princ entries by uname aab915edc1 Jim Chen recovery_fs_ng: Fix NUL termination and cid_len check in clid parser 78fd44e022 Jim Chen nfs4_op_sequence: Fix slot->sequence use-after-free on illegal replay 20f0390d5d Jim Chen recovery_fs: Fix stack buffer overflow, underflow, and NUL termination

1 0

[M] Change in ...nfs-ganesha[next]: SAL: release only the NLM state taken through a released address (#1435)
by Vinícius Ferrão (GerritHub) 30 Oct '26

30 Oct '26

Vinícius Ferrão has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257400?usp=email ) Change subject: SAL: release only the NLM state taken through a released address (#1435) ...................................................................... SAL: release only the NLM state taken through a released address (#1435) nfs_release_nlm_state() released every lock and share of the client host, also those taken through addresses that did not move. Give state_nlm_notify() a server address, and release only the state whose NLM owner came through it. SM_NOTIFY and NLM_FREE_ALL pass NULL and release everything, as before. Change-Id: Icc1b630df88823aed8f3621610a4bc311056a034 Signed-off-by: Vinícius Ferrão <ferrao(a)versatushpc.com.br> --- M src/Protocols/NLM/nlm_Free_All.c M src/Protocols/NLM/nlm_Sm_Notify.c M src/Protocols/NLM/nsm.c M src/SAL/nfs4_recovery.c M src/SAL/state_lock.c M src/include/sal_functions.h 6 files changed, 45 insertions(+), 10 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/00/1257400/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257400?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: Icc1b630df88823aed8f3621610a4bc311056a034 Gerrit-Change-Number: 1257400 Gerrit-PatchSet: 1 Gerrit-Owner: Vinícius Ferrão <vinicius(a)ferrao.net.br>

1 0

[S] Change in ...nfs-ganesha[next]: CONFIG: Add CONFOIGITEM_BOOL_SET
by Frank Filz (GerritHub) 29 Oct '26

29 Oct '26

Frank Filz has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257368?usp=email ) Change subject: CONFIG: Add CONFOIGITEM_BOOL_SET ...................................................................... CONFIG: Add CONFOIGITEM_BOOL_SET Change-Id: I638015160575cd79bfd34fe4c6348250ba6ab943 Signed-off-by: Frank S. Filz <ffilzlnx(a)mindspring.com> --- M src/config_parsing/config_parsing.c M src/include/config_parsing.h 2 files changed, 20 insertions(+), 0 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/68/1257368/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257368?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I638015160575cd79bfd34fe4c6348250ba6ab943 Gerrit-Change-Number: 1257368 Gerrit-PatchSet: 1 Gerrit-Owner: Frank Filz <ffilzlnx(a)mindspring.com>

1 0

[S] Change in ...nfs-ganesha[next]: RCU: add rcu_register_thread to some threads
by Frank Filz (GerritHub) 29 Oct '26

29 Oct '26

Frank Filz has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257344?usp=email ) Change subject: RCU: add rcu_register_thread to some threads ...................................................................... RCU: add rcu_register_thread to some threads NOTE: Since we are currently forcing urcu-bp, we don't ACTUALLY need to call rcu_register_thread, but we do it for good coding practice. NOTE: Since Ganesha does some RCU stuff from library threads that may not be RCU friendly, we are forced to use urcu-bp. Change-Id: I49584754eaa56e8a127753f374b3696a75a7de5f Signed-off-by: Frank S. Filz <ffilzlnx(a)mindspring.com> --- M src/MainNFSD/nfs_main.c M src/MainNFSD/nfs_qos.c M src/PLUGIN/kmip/kmip_fscrypt.c 3 files changed, 14 insertions(+), 0 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/44/1257344/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257344?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I49584754eaa56e8a127753f374b3696a75a7de5f Gerrit-Change-Number: 1257344 Gerrit-PatchSet: 1 Gerrit-Owner: Frank Filz <ffilzlnx(a)mindspring.com>

1 0

[M] Change in ...nfs-ganesha[next]: Fix five AddressSanitizer direct memory leaks
by Nishant Puri (GerritHub) 29 Oct '26

29 Oct '26

Nishant Puri has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257223?usp=email ) Change subject: Fix five AddressSanitizer direct memory leaks ...................................................................... Fix five AddressSanitizer direct memory leaks Release blocks that LeakSanitizer reported as direct leaks: - Free the sockaddr key when an nfs_ip_name cache entry expires or is removed. HashTable_Del was dropping the stored key. - Record the v4.1 backchannel auth flavor so an AUTH_SYS credential is destroyed with the channel. AUTH_NONE remains the shared static auth. - Drop the extra fullpath refstr taken while scanning exports by path. - Free the CB_COMPOUND4res tag allocated while decoding a callback reply. - Free the NSM nodename allocated by the notify thread, and give each SM_NOTIFY its own copy so that string can be released. Change-Id: I4526589cf9a15b261e8c4917167296f14c22bda1 Signed-off-by: Nishant Puri <npuri(a)redhat.com> --- M src/MainNFSD/nfs_rpc_callback.c M src/Protocols/NLM/nsm.c M src/support/export_mgr.c M src/support/nfs_ip_name.c 4 files changed, 51 insertions(+), 4 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/23/1257223/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257223?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I4526589cf9a15b261e8c4917167296f14c22bda1 Gerrit-Change-Number: 1257223 Gerrit-PatchSet: 1 Gerrit-Owner: Nishant Puri <npuri(a)redhat.com>

1 0

[S] Change in ...nfs-ganesha[next]: XDR: add per-field reasonableness limits for arrays and opaques
by Suhas Athani (GerritHub) 29 Oct '26

29 Oct '26

Suhas Athani has uploaded this change for review. ( https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257204?usp=email ) Change subject: XDR: add per-field reasonableness limits for arrays and opaques ...................................................................... XDR: add per-field reasonableness limits for arrays and opaques Part of GitHub issue #867. Coverity and issue #867 ask for upper bounds on XDR lengths used as array sizes. A single global max is wrong: WRITE/READ data is an opaque that must allow XDR_BYTES_MAXLEN_IO, while file handles, ACLs and bitmaps need much smaller caps. Bound bitmap4_len with BITMAP4_XDR_MAXLEN while still skipping modest excess words for forward compatibility. Cap the decode_filehandle() skip path at NFS4_FHSIZE. Reject io_data lengths above XDR_BYTES_MAXLEN_IO. Use NFS4_FHSIZE as the maxsize for pNFS FH xdr_bytes(). Align NFSv4 ACL ACE limits on NFS4_ACL_MAX_ACES and name the existing POSIX ACL cap POSIX_ACL_MAX_ENTRIES. Change-Id: I0aee6ccf0e45be4e657b501b1d0471acb00b040b Signed-off-by: Suhas Athani <Suhas.Athani(a)ibm.com> --- M src/FSAL/common_pnfs.c M src/Protocols/NFS/nfs_proto_tools.c M src/Protocols/XDR/xdr_nfsacl.c M src/RPCAL/rpc_tools.c M src/include/nfsacl.h M src/include/nfsv41.h 6 files changed, 35 insertions(+), 6 deletions(-) git pull ssh://review.gerrithub.io:29418/ffilz/nfs-ganesha refs/changes/04/1257204/1 -- To view, visit https://review.gerrithub.io/c/ffilz/nfs-ganesha/+/1257204?usp=email To unsubscribe, or for help writing mail filters, visit https://review.gerrithub.io/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: ffilz/nfs-ganesha Gerrit-Branch: next Gerrit-Change-Id: I0aee6ccf0e45be4e657b501b1d0471acb00b040b Gerrit-Change-Number: 1257204 Gerrit-PatchSet: 1 Gerrit-Owner: Suhas Athani <Suhas.Athani(a)ibm.com>

1 0